AE-aware training is relatively easy to perform when the target model is available and it is quite effective in terms of defense capability, especially for known AE attacks. However, due to the change of the target model, these techniques usually cause prediction accuracy loss [1]}, [2]}. Additionally, most of them are vulnerable to adaptive attacks.
